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Status of This Memo 


This memo provides information for the Internet community. This memo 
does not specify an Internet standard of any kind. Distribution of 
this memo is unlimited. 


Abstract 


This document provides two sets of test cases for HMAC-MD5 and HMAC- 
SHA-1, respectively. HMAC-MD5 and HMAC-SHA-1 are two constructs of 
the HMAC [HMAC] message authentication function using the MD5 [MD5] 
hash function and the SHA-1 [SHA] hash function. Both constructs are 
used by IPSEC [0G,CG] and other protocols to authenticate messages. 
The test cases and results provided in this document are meant to be 
used as a conformance test for HMAC-MD5 and HMAC-SHA-1 
implementations. 


1. Introduction 


The general method for constructing a HMAC message authentication 
function using a particular hash function is described in section 2 
of [HMAC]. We will not repeat the description here. Section 5 of 
[HMAC] also discusses truncating the output of HMAC; the rule is that 
we should keep the more significant bits (the bits in the left, 
assuming a network byte order (big-endian)). 


In sections 2 and 3 we provide test cases for HMAC-MD5 and HMAC-SHA- 
1, respectively. Each case includes the key, the data, and the 
result. The values of keys and data are either hexadecimal numbers 
(prefixed by "0x") or ASCII character strings in double quotes. If a 
value is an ASCII character string, then the HMAC computation for the 
corresponding test case DOES NOT include the trailing null character 
(‘\0’) in the string. 
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The C source code of the functions used to generate HMAC-SHA-1 
results is listed in the Appendix. Note that these functions are 
meant to be simple and easy to understand; they are not optimized in 
any way. The C source code for computing HMAC-MD5 can be found in 
[MD5]; or you can do a simple modification to HMAC-SHA-1 code to get 
HMAC-MD5 code, as explained in the Appendix. 


The test cases in this document are cross-verified by three 
independent implementations, one from NIST and two from IBM Research. 
One IBM implementation uses optimized code that is very different 
from the code in the Appendix. An implemenation that concurs with the 
results provided in this document should be interoperable with other 
Similar implemenations. We do not claim that such an implementation 
is absolutely correct with respect to the HMAC definition in [HMAC]. 


2. Test Cases for HMAC-MD5 

test_case = 1 

key = Ox0b0b0b0bObObObObObObObObObObObNb 
key_len = 16 

data = "Hi There" 

data_len = 8 

digest = 0x9294727a3638bb1c13f48ef8158bfcI9d 
test_case = 2 

key = "Jefe" 

key_len = 4 

data = "what do ya want for nothing?" 
data_len = 28 

digest = 0x750c783e6ab0b503eaa86e310a5db738 
test_case = 3 

key = Oxaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 
key_len 16 

data = Oxdd repeated 50 times 

data_len = 50 

digest = 0x56be34521d144c88dbb8c733f0e8b3f6 
test_case = 4 

key = 0x0102030405060708090a0b0c0d0e0f10111213141516171819 
key_len 25 

data = Oxcd repeated 50 times 

data_len = 50 

digest = 0x697eaf0aca3a3aea3a75164746ffaa79 
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test_case = 
key = 
key_len = 
data = 
data_len = 
digest = 
digest-—96 


test_case 
key = 
key_len = 
data = 
data_len = 
digest = 


test_case 
key = 
key_len = 
data = 


data_len = 
digest = 
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5 
Ox0cO0cO0cOcO0cO0OcOcO0cO0OcOcO0cOcO0cOcOc0c 
16 

"Test With Truncation" 

20 

0x5646lef2342edc00f 9bab995690efd4c 
0x5646lef2342edc00fI9bab995 


6 

Oxaa repeated 80 times 

80 

"Test Using Larger Than Block-Size Key - H 
54 

Oxé6éblab7fe4bd7bf£8f0b62e6ce61b9d0cd 


7 

Oxaa repeated 80 times 

80 

"Test Using Larger Than Block-Size Key and 
Than One Block-Size Data" 

73 

Ox6éf6é30fad67cda0eelfb1f562db3aa53e 


3. Test Cases for HMAC-SHA-1 


test_case = 
key = 
key_len = 
data = 
data_len = 
digest = 
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1 
0x0b0b0b0b0b0bO0bO0bO0bO0bO0bO0bO0bO0bO0bO0bO0bO0bO0bOb 
20 

"Hi There" 

8 
0xb617318655057264e28bc0b6fb378c8ef146be00 


2 

"Jefe" 

4 

"what do ya want for nothing?" 

28 
0xeffcdf6ae5eb2fa2d27416d5f184df9c259a7c79 


3 
Oxaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa 
20 

Oxdd repeated 50 times 

50 
0x125d7342b9acllcd91a39af48aal7b4f£63£175d3 
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test_case = 4 

key = 0x0102030405060708090a0b0c0d0e0f10111213141516171819 

key_len = 25 

data = Oxcd repeated 50 times 

data_len = 50 

digest = 0x4c9007£4026250c6bc8414f9bF50c86c2d7235da 

test_case = 5 

key = OxO0cOcO0cO0cOcOcO0cO0cOcO0c0cOcOcO0cOcOcO0cO0cO0c0c 

key_len = 20 

data = "Test With Truncation" 

data_len = 20 

digest = 0x4c1a03424b55e07fe7£27be1ld58bb9324a9a5a04 

digest-—96 = 0x4c1a03424b55e07fe7£27bel 

test_case = 6 

key = Oxaa repeated 80 times 

key_len = 80 

data = "Test Using Larger Than Block-Size Key - Hash Key First" 

data_len = 54 

digest = Oxaa4ae5e15272d00e95705637ce8a3b55ed402112 

test_case = 7 

key = Oxaa repeated 80 times 

key_len = 80 

data = "Test Using Larger Than Block-Size Key and Larger 
Than One Block-Size Data" 

data_len = 73 

digest = Oxe8e99d0£45237d78 6d6bbaa7965c7808bbfF1a91 

data_len = 20 

digest = 0x4c1a03424b55e07fe7£27be1ld58bb9324a9a5a04 

digest-—96 = 0x4c1a03424b55e07fe7f£27bel 

test_case = 6 

key = Oxaa repeated 80 times 

key_len = 80 

data = "Test Using Larger Than Block-Size Key - Hash Key 

First" 

data_len = 54 

digest = Oxaa4ae5e15272d00e95705637ce8a3b55ed402112 

test_case = 7 

key = Oxaa repeated 80 times 

key_len = 80 

data = "Test Using Larger Than Block-Size Key and Larger 
Than One Block-Size Data" 

data_len = 73 

digest = Oxe8e99d0£45237d78 6d6bbaa7 965c7808bbfF1a91 
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4. Security Considerations 


This docuemnt raises no security issues. Discussion on the strength 
of the HMAC construction can be found in [HMAC]. 
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Appendix 


This appendix contains the C reference code which implements HMAC- 
SHA-1 using an existing SHA-1 library. It assumes that the SHA-1 
library has similar API’s as those of the MD5 code described in RFC 
1321. The code for HMAC-MD5 is similar, just replace the strings 
"SHA" and "sha" with "MD5" and "md5". HMAC-MD5 code is also listed in 
RFC 2104. 


#ifndef SHA DIGESTSIZE 
#define SHA DIGESTSIZE 20 
#endif 


#ifndef 
#define 
#endif 


n 


HA BLOCKSIZE 
HA BLOCKSIZE 64 


n 


#ifndef MD5 DIGESTSIZE 
#define MD5 DIGESTSIZE 16 
#endif 


#ifndef MD5 BLOCKSIZE 
#define MD5 _BLOCKSIZE 64 
#fendif 


/* Function to print the digest */ 
void 

pr_sha(FILE* fp, char* s, int t) 

{ 


int uF 


fprintf (fp, "0x") 
for (i = 0 ; i < t ; itt) 
fprintf(fp, "%s02x", s[i]l) ; 
fprintf(fp, "0) ; 
} 


void truncate 

( 

char* dl, /* data to be truncated */ 
char* d2, /* truncated data */ 


int len /* length in bytes to keep */ 
) 
{ 
int li, ae 
for (i = 0; i< len; i++) d2[i] = dal[il; 
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/* Function to compute the digest */ 


void 
hmac_sha 
( 
char* k, /* secret key */ 
int 1k, /* length of the key in bytes */ 
char* d, /* data */ 
int ld, /* length of data in bytes */ 
char* out, /* output buffer, at least "t" bytes */ 
int t 


SHA_CTX ictx, octx ; 


char isha[SHA_DIGESTSIZE], osha[SHA_DIGESTSIZE] ; 
char key [SHA_DIGESTSIZE] ; 

char buf [SHA_BLOCKSIZE] ; 

int At. 33 


if (lk > SHA_BLOCKSIZE) { 
SHA CTX ECER ; 
SHATnit (&tctx) ; 
SHAUpdate (&tctx, k, 1k) ; 
SHAFinal (key, &tctx) ; 
k = key ; 
al: 


k = SHA_DIGESTSIZE ; 
} 


/**** Inner Digest ****/ 

SHATnit (&ictx) ; 

/* Pad the key for inner digest */ 

for (i = 0; i < 1k ; ++i) buf[i] = k[i] ^ 0x36 ; 

for (i = 1k ; i < SHA_BLOCKSIZE ; ++i) buf[i] = 0x36 ; 


SHAUpdate (&ictx, buf, SHA_BLOCKSIZE) ; 
SHAUpdate(&ictx, d, ld) ; 


SHAFinal(isha, &ictx) ; 
/**** OQutter Digest ****/ 
SHAInit (&0ctx) ; 


/* Pad the key for outter digest */ 
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for (i = 0; i< 1k; ++i) buf[i] = k[i] ^ 0x5C ; 
for (i = 1k ; i < SHA_BLOCKSIZE ; ++i) buf[i] = 0x5C ; 


SHAUpdate (&0ctx, buf, SHA_BLOCKSIZE) ; 
SHAUpdate (&octx, isha, SHA _DIGESTSIZE) ; 


SHAFinal(osha, &octx) ; 
/* truncate and print the results */ 
t = t > SHA_DIGESTSIZE ? SHA _DIGESTSIZE : t ; 


truncate(osha, out, t) ; 
pr_sha(stdout, out, t) ; 
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